jenkinsci / jenkins-charm / 47

100%

push

travis-ci

Bundle the jenkins.io apt repository key within the charm (#20)

Bundle the jenkins.io apt repository key in the charm

The jenkins charm currently fetches the repository key using http at
install time before using it to validate the apt repository. This
leaves it open to man-in-the-middle attack. If an attacker can
redirect jenkins.io to a bogus server, that server could contain
both a signed archive and a public key it was signed with.

This change provides the key within the charm itself so that we're
validating with a known valid key.

4 of 4 new or added lines in 1 file covered. (100.0%)

308 of 308 relevant lines covered (100.0%)

1.0 hits per line